The integrity of our educational and research missions is critically important. Given that most of our daily activities are executed on or enabled by IT systems—from laptops and mobile devices to servers and high-performance computing platforms—threats to those systems endanger our mission.

Confronting these ongoing attacks and their inherent risks will require every member of our community’s commitment and action. These requirements apply to any system that connects to the HMS network or that is used to conduct HMS business. These systems include laptops, desktop computers, servers, and grant-purchased hardware and software.

Security requirements

  • Requirements for all

    Install security software and stay up-to-date
    Install software Update your OS

    This software and these updates must be applied to any Harvard-owned or grant-purchased system connected to the HMS network or used to conduct HMS business. These systems include laptops, desktop computers, and grant-purchased hardware and software. These requirements, combined with two-factor authentication (2FA), helps protect your data.

    None of this software tracks or reports on the data stored on your computer.

    The requirements include:

    • Systems management software (SMS) – Install systems management software (SMS) to enable HMS IT to keep systems up-to-date with the latest security patches and virus definitions. After you install SMS, the threat-monitoring software CrowdStrike will be automatically installed.  
    • Threat-monitoring software – Install CrowdStrike, which helps Harvard respond quickly to advanced attacks using malware and stolen credentials.
    • Antivirus software – Install ESET antivirus software if you are quad-based faculty and staff. We recommend that others install Avast for macOS or use the built-in Windows Defender for Windows computers. 
    • Updates to your computer’s operating system and software – Immediately install updates that address security vulnerabilities. Apply other updates within 30 days of their release. To check if your system is up-to-date, review the HMS-supported operating systems.
  • Requirements for system administrators

    Ensure your systems are compliant
    Add 2FA Apply patches
    • Secure administrative accounts used to manage HMS software or systems – Enable two-factor authentication (2FA) to secure all administrator accounts on the systems you manage.
    • Enable 2FA for all users on any HMS software or systems you manage – Email to request a security review of your authentication methods.
    • Update your operating systems and apply patches to servers – Immediately install updates that address security vulnerabilities. Apply other updates within 30 days of their release.
    • Remove internet access for outdated hardware and software – Block internet access to any system with hardware or software that the manufacturer no longer supports.
    • Deploy vulnerability-scanning software – Uncover weaknesses across your systems by deploying CrowdStrike and Tenable® scanning software. Connect to a VPN to download this software, then email for assistance in configuring the software for your environment.


Follow these guidelines to keep your information secure
Privacy and security for Dropbox accounts at HMS
Connect to campus resources through a secure VPN


Learn about the HMS policy on cybersecurity
See which tools to use based on the info you're sharing
Learn commonly used security terms at HMS IT